DQM Core Units

Organizational Risks and Opportunities flashcards

Read the question, say the answer to yourself, then turn the card to check. The first 10 of 47 cards are free; the rest come with the subject.

Card 1 of 47

Jump to a card

Complete Flashcard Reference

Review every card in this deck. Open any card to reveal its answer. The first 10 are free; the other 37 come with the subject.

What is risk, and why can it be positive as well as negative?

Risk is the effect of uncertainty on objectives. The same uncertainty that could produce a threat (a negative risk) could equally produce an opportunity (a positive risk).

A Kisumu hotel estimates a 20% chance of a flood that would cost it KES 3,500,000. What is the expected monetary value of the risk?

EMV = probability x impact. EMV = 0.20 x 3,500,000 = KES 700,000. The single figure lets this risk be compared with others on a like-for-like basis.

What five elements should a risk treatment plan include?

1. The specific action(s) to be taken. 2. Who is responsible for implementing them. 3. The resources required. 4. The timeline for implementation. 5. How success will be measured.

How does monitoring a risk differ from reviewing the risk management framework?

Monitoring a risk tracks how a specific known risk changes over time against what was assessed. Reviewing the framework is a broader, periodic check of whether the whole risk management system is actually improving decisions and reducing losses.

What are the five risk classifications?

Strategic: threatens high-level organisational objectives. Operational: day-to-day processes, people or systems failing. Financial: cash flow, credit, market or investment exposure. Compliance (legal): failing to meet legal or regulatory requirements. Reputational: damage to how stakeholders perceive the organisation.

What does a risk matrix do?

It plots likelihood against impact on a grid to give each risk a simple priority rating. It is the tool most exam scenarios expect you to apply directly: plot the described risk and justify its priority.

Which risk strategy applies only to an opportunity, and what does it involve?

Exploit. It means taking deliberate action to increase exposure to a risk that represents an opportunity, for example entering a new export market because the potential profit outweighs the currency risk.

A treatment plan says 'install a backup generator' but names no one responsible and no date. Why is it incomplete?

Without an owner and a timeline, nobody is accountable for making the action happen or by when, so the plan cannot be tracked or enforced. The owner and the timeline are the elements most often missing in a 'critique this plan' question.

What does risk governance assign?

Clear accountability for risk management at every level, from a board-level risk committee setting overall direction down to individual risk owners.

What do acceptance criteria state?

The threshold, tied to the risk criteria and risk appetite, above which a risk requires treatment and below which it can be accepted as it stands. They give risk evaluation a defensible, consistent basis rather than an ad hoc judgement call.

How is risk management defined?